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^ Abstract 

00 Suppose some data have been encrypted, can you compute with the data 

without decrypting them? This problem has been studied as homomorphic 

""I encryption and bhnd computing. We consider this problem in the context 

Q_i of quantum information processing, and present the definitions of quantum 

homomorphic encryption (QHE) and quantum fully homomorphic encryption 

(QFHE). Then we construct a symmetric QFHE scheme based on quantum 

^ one-time pad. This scheme permits any unitary transformation on any n- 
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qubit state that has been encrypted. Compared with classical homomorphic 
encryption, the QFHE scheme has perfect security. 

^ Keywords: Quantum cryptography, homomorphic encryption, quantum 
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■^ 1. Introduction 

o 

^ Suppose you have encrypted some data, you intend to compute with the 

^ data, but you do not want to decrypt them. Is it possible to compute with 

the encrypted data without decryption? 

This problem is related with the study "information processing with en- 
C^ crypted data" or "privacy-preserving quantum computing". It has been in- 

vestigated a lot in modern cryptography, and includes the studies of homo- 
morphic encryption [1] and blind computing [2, 3]. It was first considered 
by Rivest et al. who suggest some homomorphic encryption schemes [1]. 
However, these schemes are insecure [4]. Later, more results are proposed 
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about homoinorphic encryption and fully homomorphic encryption [5, 6]. 
These are constructed based on some hard computational problems in math- 
ematics, and their security relies on the computational difficulty of these 
mathematical problems. Thus they have just computational security. 

Based on the theory of quantum mechanics, lots of quantum crypto- 
graphic protocols [7-9] have been proposed, and have unconditional security. 
This stimulates us to consider the above problem in the context of quan- 
tum information, and intend to get a more secure solution to the privacy- 
preserving quantum computing. The closely related with the problem in- 
cludes: 1) blind quantum computing [10-20], where one party delegates quan- 
tum computation to another party without revealing his data and result; 2) 
quantum homomorphic encryption (QHE) [21], which allows quantum data 
to be manipulated without decrypting; 3) quantum private query [22] , which 
is used to query a database while keeping the query secret; and 4) quantum 
private comparison [23-27], which allows two parties to compare their secret 
data without revealing the secret. 

This paper considers the problem of homomorphic encryption in the con- 
text of quantum information processing: suppose arbitrary quantum plain- 
text a has been encrypted (the ciphertext is S{a)), can we perform any quan- 
tum operator directly on the ciphertext (without decrypting the ciphertext) 
and obtain the desired state £(T{a))7 The state £(T{a)) is the ciphertext 
of the result of performing quantum operator T on the original plaintext a. 

Rohde et al. [21] studied quantum walk with encrypted data, and pro- 
posed a limited QHE scheme using the Boson sampling and multi-walker 
quantum walk models. This QHE scheme can be used in blind computing of 
quantum walk. However, QHE has still not been defined and quantum fully 
homomorphic encryption (QFHE) scheme has not been constructed. 

We study the quantum information processing with encrypted data from 
the aspect of QHE. The definitions of QHE and QFHE have been presented, 
and some concrete schemes including QFHE scheme have been constructed. 
All these schemes are constructed based on quantum one-time pad (QOTP) 
[28, 29], and have perfect security. 

2. Concepts 

In Ref. [21], a limited QHE scheme was presented using the Boson sam- 
pling and multi-walker quantum walk models. However, no definition of QHE 
or QFHE has been given, and no QFHE scheme has been constructed. 



QHE can be either symmetric or asymmetric. Both of the two kinds 
will be defined, but we will focus on the symmetric QHE. All the schemes 
constructed in the next sections are symmetric QHE schemes. 

Definition 1: A symmetric quantum homomorphic encryption scheme 
A has the following four algorithms: 

1. Key Generating algorithm KeyGeuA is used to generate a key key; 

2. Encrypt^ is the encryption algorithm: p = S{key,cT), where a is the 
quantum plaintext; 

3. Decrypt^ is the decryption algorithm: a = T?{key,p), where p is the 
quantum ciphertext; 

4. The algorithm Evaluate^ is used to process the quantum ciphertext 
without decryption. Evaluate^ is associated to a set J-a of permitted 
quantum operators. For any quantum operator T G J-a, according 
to the key key and quantum ciphertext p, it performs the algorithm 
Evaluate^{key,T, p), and can output a quantum state which is just 
the ciphertext S{key,T{a)). 

Definition 2: An asymmetric quantum homomorphic encryption scheme 
A has the following four algorithms: 

1. Key Generating algorithm KeyGen^ is used to generate two keys - a 
public key pk and a secret key sk; 

2. Encrypt/^ is the encryption algorithm: p = £{pk^a)^ where a is the 
quantum plaintext; 

3. Decrypt/^ is the decryption algorithm: a = V{sk,p), where p is the 
quantum ciphertext; 

4. The algorithm Evaluate^ is used to process the quantum ciphertext 
without decryption. Evaluate^ is associated to a set J-a of permitted 
quantum operators. For any quantum operator T G J-'a, according to 
the public key pk and quantum ciphertext p, it performs the algorithm 
Evaluate^ipkyT, p), and can output a quantum ciphertext which can 
be decrypted as T{o-) with the secret key sk. 

Compared with the usual encryption scheme, the QHE scheme has a 
fourth algorithm Evaluate a, which is used to process the encrypted data. 
For example, the algorithm Evaluate a may be described as this: from the key 
and the quantum operator T G J-'a, it generates another quantum operator 



T' and performs it on the quantum ciphertext S{key,a). In this case, the 
operator T' is related with the operator T and the key, such that 

T\Sikey,cj))=Sikey,Tia)). (1) 

The operator T can be regarded as an desired operation on the quantum 
plaintext. The operation T' corresponding to T is performed on the quantum 
ciphertext, and can implement the desired operation on the plaintext. 

From the definitions of symmetrc/asymmetric QHE scheme, we say the 
scheme A can handle all the quantum operators in J-^. 

The scheme A is (symmetric or asymmetric) quantum fully homomorphic 
encryption scheme, if it can handle all quantum operators and Evaluate^ 
is efficient in a similar way as in Ref. [6]. The quantum operator T G J-a 
may be uncomputable in polynomial time, and suppose its running time is 
St- We say Evaluate a is efficient if there exists a polynomial g such that, 
for any quantum operator T G J-a that can be implemented in time St, 
Evaluate A can be implemented in time at most 5*^ ■ 5'(A), where A is the 
security parameter. 

The security of QHE scheme depends on the security of the encryption 
algorithm Encrypt a- In the asymmetric QHE scheme, the security also 
depends on the privacy of the secret key sk while the key pk is public. 

3. Quantum homomorphic encryption 

Some operators are introduced firstly. Four single-qubit operators X, Y, Z, H 
are shown as follows: X = { j,F=| . j,Z=| 

if = 4= I J . Two-qubit operator controlled-NOT is denoted as 

CNOT. The rotation operators about the z and y axes are defined by 
RziO) = e~*^-^/^ and Ry{0) = e~*^^/^. See the Appendix for some of their 
commutation rules. All the equations used in this paper can be deduced 
from those commutation rules. 

In this section, we will firstly present three QHE schemes on single qubit, 
whose permitted quantum operators are in the set {Rz{9)\9 G [0,27r)}, 
{Ry{6)\6 G [0, 27r)} or the union of them. Then a QHE scheme for CNOT is 
also constructed. 

In the first QHE scheme, the set of permitted quantum operators is 
{Rz{6)\6 G [0,27r)}. The scheme is shown as follows. 



QHE scheme 1 

KeyGen^: Randomly select two bits k G {0, l},j G {0, 1}; 

EncryptA'- Compute pc = X^ Z^amZ^X^] 

Decrypt a: Compute am = Z^X^ pcX^Z^] 

Evaluate/^: According to k,j,Rz{9), it performs quantum operator Rz{0') 
on the given quantum ciphertext pc, where 6' = {—lyO. 

It can be verified that 

R,{{-iye)x^z'' = x^z^R,{e), (2) 

where k G {0,1}, j G {0,1}. According to Eq.(2), the output state of the 
algorithm Evaluate ^ is 

R,{{-iye)p,R,{{-iyey = x^z\RMamR.{ey)z''x\ 

which is just the ciphertext of the state Rz{9)(7mRz{(^y ■ Moreover, no de- 
cryption is performed during the computing of Evaluate a- Thus the scheme 
satisfies the definition of symmetric QHE, and all the unitary transforma- 
tions in {Rz{6)\6 G [0,27r)} are permitted quantum operators of the QHE 
scheme. 

In the second QHE scheme, the set of permitted quantum operators is 
{Ry{6)\6 G [0, 27r)}. The scheme is shown as follows. 

QHE scheme 2 

KeyGeriA- Randomly select two bits k G {0, 1}, j G {0, 1}; 

Encrypt^- Compute pc = X^ Z^amZ^X^] 

Decrypt^'- Compute am = Z^X^ p^X^Z^] 

Evaluate A- According to k,j,Ry{9), it performs quantum operator Ry{6') 
on the given quantum ciphertext p^? where 9' = {—iy~^W. 

It can be verified that 

Ry{{-iy+^9)X'Z'' = X^Z^Ry{e), (3) 



where k G {0,1}, j G {0,1}. According to Eq.(3), the output state of the 
algorithm Evaluate^ is 

Ryi{-lf+^9)p,Ryi{-l)''+^9y = X^Z\Ry{9)amRyi9y)Z'X\ (4) 

which is just the ciphertext of the state Ry{9)amRy{9y . Moreover, no de- 
cryption is performed during the computing of Evaluate /\. Thus the scheme 
also satisfies the definition of symmetric QHE, and all the unitary transfor- 
mations in {Ry{9)\9 G [0, 2n)} are permitted quantum operators of the QHE 
scheme. 

Remark 1: The relation Ry{{-iy9)WY'' = WY^Ry{9) can be easily 
verified. So, in the QHE scheme 2, the encryption/decryption algorithm can 
also be modified by replacing X^Z^ with H^Y^ , and the algorithm Evaluate/^ 
performs quantum operator Ry[{—iy9) on the given quantum ciphertext. 

The third QHE scheme can be constructed by combining the scheme 1 
and scheme 2, and its permitted quantum operators are in {Rz{9), Ry{9)\9 G 
[0, 27r)}. The only modification is about the algorithm Evaluate/^, and the 
modified Evaluate/^ is described as follow: according to the key /c,j and 
Rz{9) (or Ry{9)), perform quantum operator R:,{{-iy9) (or Ry{{-lY^^9)) 
on the given quantum ciphertext pc- 

Until now, we have presented three symmetric QHE schemes, such that 
the permitted quantum operators are in {Rz{9)\9 G [0,27r)}, {Ry{9)\9 G 
[0,27r)}, or the union of them. All these schemes are constructed based 
on QOTP. In these constructions, each permitted quantum operator T G 
{Rz{9) ^ Ry{9)\9 G [0,27r)} is corresponding to another quantum operator T' 
which is directly performed on the quantum ciphertext. Finding the operator 
T' is the key point to construct a QHE scheme. 

Next, we construct a symmetric QHE scheme that permits CNOT oper- 
ator. It can be verified that 

{X^Z^ ® X^Z'^)CNOT = CNOT{{-iy-"'Z"' ® X^){X^Z'' ® X'Z™), (5) 

where j, k, /, m are arbitrary four bits. Denote CNOT' = CNOT{{-iy-"'Z"^^ 
X^), then the Eq.(5) can be written as CNOT'{X^Z'' O X'Z™) = {X^ Z'' ® 
X''Z"^)CNOT, so the operator CNOT' is corresponding to CNOT. From 
this relation, the QHE scheme can be constructed in the same way as fol- 
lows. In the encryption/decryption algorithm, the QOTP is used to en- 
crypt/decrypt two qubits with 4-bit key j,k,l,m. According to the key 
j, k,l,m, the algorithm Evaluate^ performs CNOT' on the given quantum 
ciphertext. 
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4. Quantum fully homomorphic encryption 

Based on the QHE schemes in the previous section, the QFHE scheme can 
also be constructed for any n-qubit quantum computation (without quantum 
measurements) . 

From the Ref. [30], any single-qubit unitary transformation can be writ- 
ten as the form 

f/(a,/3,7,5) = e"'R,il3)Ryil)Rzi5), (6) 

where a,/3,7,(5 are real numbers in the [0,27r). It means all the single-qubit 
unitary transformations can be expressed as the set {U{a, /3, 7, S)\a, 13,^,6 E 
[0,27r)}, where f/(a,/3,7,5) = e'"R,iP)Ryi^)R,i6). 

According to Eq.(2) and Eq.(3), it can be concluded that 

X^Z^'[/(a,/3,7,<5) = e'''X^Z'R,{P)Ry{-f)R,{6), 

= e'°i?,((-iy/3)X^Z%(7)i?,(5), 

= e'^R,ii-iyp)Ryii-l)''+^^)X^Z'R,i6), 

= e'"R,ii-iymyii-'^)'^'l)Rzii-'^yS)X^Z\ 

= Uia,i-iy^,i~l)'+^^,i-iy6)X^Z\ (7) 

where k G {0, 1}, j G {0, 1}. 

From Eq.(7), any single-qubit unitary operator U{a, (3, 7, 6) is correspond- 
ing to U{a, (-1)^73, (-1)^+^7, i-iyS). So the QFHE scheme for single-qubit 
computation is constructed in the same way as the construction of QHE 
schemes in the previous section. 

QFHE on single qubit 

KeyGeri/^: Randomly select two bits k G {0, 1}, j G {0, 1}; 

Encrypt/^: Compute Pc = X^ Z^amZ^X^; 

Decrypt a: Compute am = Z^X^ pcX^Z^] 

Evaluate/^: According to A;, j and f/(a, /3, 7, 5), it performs the unitary trans- 
formation U{a, {—ly (3, (— 1)''"*'-'7, {—lyS) on the given quantum ci- 
phertext pc- 

According to Eq.(7), the output state of the algorithm Evaluate/^ is 

X^Z\U{a, /3, 7, 5)amU{a, /3, 7, 5y)Z''XK 



Thus the scheme also satisfies the definition of symmetric QHE. Moreover, 
Evaluate/^ has the same computational complexity with the quantum opera- 
tor U{a, /3,7, S) e J-A, and the set {U{a, f3,'j, 6)\a, (3,^, S e [0, 27r)} contains 
all of the single-qubit unitary transformations, so the above QHE scheme is 
fully homomorphic for single-qubit computation. 

Notice that while intending to perform any given unitary operator on a 
quantum ciphertext, the unitary operator should be firstly decomposed into 
the form of Eq.(6) (or computing the four parameters a, /3, 7, S). 

Next, we present another scheme, which will be shown to be a QFHE 
scheme, and permits any n-qubit unitary transformation. 

Any n-qubit unitary transformation can be decomposed as the combi- 
nation of some CNOT and single-qubit unitary transformations. Then any 
n-qubit computation (without quantum measurements) can be described as 
a quantum circuit C, which consists of some CNOT and single-qubit unitary 
gates [31]. From the above constructions of QHE schemes, the CNOT gate 
or each single-qubit unitary gates f/(a,/3,7,(5) can correspond to another 
quantum gate CNOT' or U{a, (-1)^/3, (-l)''+^7, (-!)■' (5). By replacing each 
gate in quantum circuit C with the corresponding quantum gate, we can 
obtain a new quantum circuit, denoted as C. The two quantum circuits C 
and C satisfy the relation 

C'iX'^'Z''' ® ■ ■ ■ X""Z''") = (X^iZ^i ® ■ ■ ■ ® X'^-Z^")^, (8) 

where a = ai ■ ■ ■ a„ and 6 = 61 • ■ ■ 6„ are arbitrary n-bit strings selected from 
{0, 1}". The circuit C is dependent on the circuit C and the two numbers 
a, b. 

From Eq.(8), the QFHE on n qubits can be constructed as follows. QOTP 
is used as the encryption/decryption algorithms again, and it needs a 2n-bit 
key to pefectly encrypt n-qubit plaintext, and obtains an n-qubit ciphertext. 
According to the key, the algorithm Evaluate^ replaces each gate in quan- 
tum circuit C with its corresponding gate, and gets a new quantum circuit 
C, and then puts the n-qubit ciphertext as the inputs of C. The output 
state of C can just be decrypted according to QOTP, and get the result of 
performing quantum circuit C on the original plaintext. Thus, this QFHE 
scheme permits any n-qubit unitary circuit C to be performed on n qubits 
that have been encrypted, and no decryption is needed. 

Next, the size of quantum circuit C is analyzed. From the relation 
CNOT' = CNOT{{-iy-'^Z'^ (g) X^), the gate CNOT' can be implemented 
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by at most 3 quantum gates (e.g. CNOT, Z,X). So, while constructing the 
new quantum circuit C, each CNOT gate in the circuit C is replaced with 
at most 3 quantum gates. On the other hand, each single-qubit gate in C is 
only corresponding to 1 single-qubit gate. Then, we can conclude that, the 
size of the new circuit C is not more than three times of the size of C. Thus, 
the complexity of Evaluate/^ is at most three times than that of the circuit 
C, and then the algorithm Evaluate /^ is efficient. 

It follows from the above analysis that, this scheme is indeed a QFHE 
scheme, which permits any n-qubit unitary transformation. 

5. Analysis 

The security of these QHE and QFHE schemes is analyzed. 
Theorem 1: All the QHE and QFHE schemes proposed in the previous 
sections are perfectly secure. 

Proof: Firstly, it can be verified that [28] 

^ V X''Z\Z''X^ = — /sn, (9) 

22n / ^ 2" 

a,fee{0,l}" 

where r is arbitrary n-qubit state. 

In all these schemes, QOTP is used as the encryption/decryption algo- 
rithm. Suppose the single-qubit plaintext am is encrypted by QOTP using 
secret key j,k e {0,1}, which is unknown to the attacker. With regard to the 
attacker, the output of the algorithm Encrypt^ is ^ ^ • ^g|Q ^i X^ Z^a^Z^X^ 
which is just the totally mixed state according to Eq.(9). Moreover, the out- 
put of EvaluateA with regard to the attacker is 



J_ ^ U{a, (-1^/3, (-l)'=+^7, i-iy5)p,Uia, (-1^/3, (-l)'=+^7, (-1)^'^)^ 
j,ke{o,i} 

= ^ E X^Z'Uia,P,^,6)amUia,P,^,6yZ>'X^ = h2, 

i,fc6{0,l} 

which is also the totally mixed state. Similarly, the same result can be 
obtained for the ra-qubit QFHE scheme. Thus, with regard to the attacker, 
the outputs of the algorithms Encrypt/^ and Evaluate/^ in each QHE/QFHE 
scheme are totally mixed states. It means these QHE and QFHE schemes are 



also perfectly secure, and the attacker can obtain nothing about the plaintext 
and the result of evaluation. D 

All the QHE schemes presented here are constructed based on QOTP. It 
should be noticed that, the algorithm Evaluate^ is dependent on the secret 
key. This may restrict the application of these schemes, because only the 
owner of the secret key can process the encrypted qubits correctly. Does 
there exist a QOTP-based symmetric QHE scheme, in which the algorithm 
Evaluate/^ is independent of the secret key? Next, we can present a negative 
answer to this question. 

Theorem 2: In the QOTP-based QHE(QFIIE) scheme, if the algorithm 
Evaluate/^ is independent of the secret key, then the set of permitted unitary 
transformations is {e^^I\6 G [0,27r)}. 

Proof: In the QOTP-based QHE scheme, if it is required that EvaluateA 
is independent of the secret key k,j G {0, l}", then all the permitted unitary 
transformations are in the set 

{C\X^Z''CZ''X^ is independent of k,j G {0, 1}"}. 

The reason is as follows. The permitted unitary operator C and the en- 
cryption should satisfy the relation {X^Z'^)C = C'{X^Z'^), where C is the 
unitary operator which is performed directly on the ciphertext. From the re- 
quirement that EvaluateA is independent of the secret key k,j G {0,1}", 
the unitary operator C is also independent of k,j. Moreover, because 
C = X^ Z^CZ^X^ , the permitted unitary transformations can be repre- 
sented as the set {C\X^Z^CZ^X^ is independent of k,j G {0, 1}"}. Next, 
we can prove the set is equal to {e*^/2n|6' G [0, 2tt)}. 

Because {X^ Z'^\k,j G {0,1}"} is a complete orthogonal basis in the n- 
qubit Hilbert space, any n-qubit unitary operator C can be represented as 

c = Ea,be{o,i}-^a,bX^zK Thenx^z^cz^x^ = Za^m}- ^-fii-ir"'''-' x^ Z\ 

where "■" denotes inner product modular 2. Because X^ Z'^CZ^X^ is inde- 
pendent of k,j, it can be deduced that, V(A;i, ji) 7^ {k2,J2), 



a,h 



So, 



«a,fe ((-1)-'=^®'"^-^ - (_i)-fe©H2) ^ o,Va,6,V(A;i,ji) ^ (A;2,j2). 
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Because it is impossible that aa^ = 0, Va, b (otherwise C = 0), 

a-ki®b-ji = a- k2®b- J2,3a,b,\f{ki,ji) ^ {k2,J2)- 

Then 

(a, 6) ■ {ki-k2,3i -J2) = 0,3a,b,\f{ki -k2,ji - J2) ^ (0,0). 

Thus it concludes that (a, 6) = (0,0), and C = ao,o^°^° = e'^^h^, V^ e 
[0,27r). Thus complete the proof. D 

We can conclude from the above theorem, it is impossible to construct a 
QOTP-based symmetric QHE scheme which satisfies both the two conditions: 
1) the algorithm Evaluate^ is independent of the secret key; 2) it permits 
all n-qubit unitary transformations on the encrypted qubits. 

6. Discussions 

The symmetric QFHE scheme has been constructed. Suppose you have 
encrypted a qubit with this scheme, you can perform any single-qubit unitary 
operator on the qubit without decryption. If you intend to delegate the 
unitary operator to another party, you have to preshare the key with that 
party, thus that party may decrypt it and obtain the original qubit. So the 
symmetric QFHE scheme proposed here cannot be used in blind computing. 
However, you can still delegate the computation to the trusted party by using 
the QFHE scheme, which can prevent the malicious parties from obtaining 
the data and the result of computation. 

The symmetric QFHE scheme may be used in secure multiparty quantum 
computation [32, 33], where n parties participate in a computation (e.g. an 
evaluation of a unitary circuit C). Suppose the circuit C is given n quantum 
inputs and output n quantum states, each of which is desired by one party. A 
naive multiparty computation protocol is given as follows. Each participant 
preshares a secret key with trusted third party (TTP) through quantum key 
distribution (QKD), and encrypts his inputs with his secret key according 
to the QFHE scheme, and then sends his ciphertext to TTP. TTP performs 
quantum circuit C (which is relative to C and all the keys shared between 
TTP and every party) on all the ciphertexts, and sends back the results to 
each party. Then each party can decrypt the received state with his secret 
key, and obtain the desired result. 
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Besides the hoinomorphic encryption, blind computing is another kind 
of study about privacy-preserving computation. Actually, homomorphic en- 
cryption and blind computing are two closely related research directions. 
Homomorphic encryption scheme can be used in blind computing in the fol- 
lowing two cases: (1) Homomorphic encryption scheme is symmetric, and 
the algorithm Evaluate/^ is independent of the key key (This case has been 
partially excluded when QFHE is constructed based on QOTP); (2) Homo- 
morphic encryption scheme is asymmetric. In blind computing, the decryp- 
tion /(c) — )• /(m) is unnecessarily the inverse of the encryption m ^ c (See 
Refs.[2, 10]). However, in the homomorphic encryption scheme, the decryp- 
tion algorithm is just the inverse of the encryption algorithm. 

In the QFHE scheme, 2n bits of key are needed to encrypt n qubits with 
perfect security. To reduce the length of key, the QOTP can be replaced with 
approximate QOTP [34]. However, the security would be slightly weaker. 

This paper considers the symmetric QHE, and the asymmetric QHE is 
only defined but not constructed. So the open problem is: how to construct 
an asymmetric QHE scheme, where the algorithm Evaluate/\ depends only 
on the public key pk but not the secret key ski Or you can consider how 
to modify the quantum public-key encryption scheme in Ref.[35], such that 
it becomes an asymmetric QHE scheme. If this goal were achieved, the 
computing on the quantum ciphertext could be securely outsourced, and 
then the blind quantum computing would be implemented in this way. 

7. Conclusions 

This paper defines symmetric and asymmetric QHE, and proposes four 
symmetric QHE schemes that permit all the quantum operators in the set 
{R^{e)\e e [0,27r)}, {Ry{e)\e e [0,27r)} or {CNOT}. Moreover, we con- 
struct a symmetric QFHE scheme, which permits any unitary operator on 
single qubit. Then the QFHE scheme is extended to permit any n-qubit 
unitary operator. All these schemes are constructed based on QOTP, and 
have perfect security. 
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Appendix 

This section lists some commutation rules about the operators X, Y, Z, H, 
CNOT, Rz{9), Ry{9). Here, j, k, l,m are single-bit numbers. 

Z'^X^ = {-iy-''x^z\ 

RMX' = X^R,{{-iy9),\/9 e [0,27r), 



Ry{9)X^ = 


xm. 


,{{-iy9),'i9e [0,27r) 


Ry{9)Z' = 


Z'Ry 


{{~lf9),'i9 e [Q,2n), 


Ry{9)W = 


WR^ 


,{{-iy9),^9e [0,27r) 


CNOT{X^ 


''®I) 


= {X^ ® X^)CNOT, 


CNOT{Z'' 


®I)-- 


= {Z'' ® I)CNOT, 


CNOT{I ® X') : 


= {I®X^)CNOT, 


CNOT{I ® Z") 


= (Z™ ® Z"')CNOT. 



15 



